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Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was established by 
the Homeland Security Act of 2002 (Public Law 107-296) by amendment to the Inspector General 
Act of 1978. This is one of a series of audit, inspection, and special reports prepared as part of our 
oversight responsibilities to promote economy, efficiency, and effectiveness within the department. 

This report assesses the internal controls related to the review and approval of contractor invoices for 
Bureau of Customs and Border Protection's (CBP's) Automated Commercial Environment contract. 
It is based on interviews with employees and officials of relevant agencies and institutions, direct 
observations, and a review of applicable documents. 

The recommendations herein have been developed to the best knowledge available to our office, and 
have been discussed in draft with those responsible for implementation. It is our hope that this 
report will result in more effective, efficient, and economical operations. We express our 
appreciation to all of those who contributed to the preparation of this report. 




Richard L. Skinner 
Inspector General 
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Executive Summary 

The Bureau of Customs and Border Protection (CBP) is developing the 
Automated Commercial Environment (ACE), a new cargo processing system 
that was initiated to modernize the targeting, inspection, enforcement, border 
security, revenue collection, and trade statistics processes for all cargo 
entering and leaving the United States. In August 2001, CBP awarded the 
ACE development contract to the e-Customs Partnership (eCP), a coalition of 
contractors headed by the prime contractor, International Business Machines 
Global Services (IBM). ACE is scheduled for completion in September 201 1 
at an estimated cost of $3.0 billion. As of May 2005, CBP had paid eCP over 
$760 million. The CBP Cargo Systems Program Office (Program Office) 
manages the ACE development and shares responsibility with the Contracting 
Office for the review and approval of eCP's invoices. 

The overall objective of the audit was to assess the internal controls related to 
the review and approval of ACE contractor invoices. The audit focused on 
two specific questions: (1) Were the procedures, processes, and internal 
controls adequate to verify the accuracy, reliability, and completeness of 
contractor invoices prior to payment? (2) Was the process for evaluating the 
quality of contractor performance and related award and incentive fee 
payments effective? 

CBP's internal controls for the review and approval of invoices were not 
adequate. Specifically, (1) written guidance describing review procedures 
were not sufficiently detailed, (2) reviewers did not always document the 
review activities performed, and (3) CBP did not sufficiently research the 
causes for issues identified during reviews. Internal controls over the process 
for evaluating contractor performance and related award and incentive fee 
payments were adequate. We recommended CBP streamline and strengthen 
the internal controls over the invoice review process and request the Defense 
Contract Audit Agency (DCAA) to perform an incurred cost audit. CBP 
concurred with the recommendations. 

Background 

CBP receives one eCP invoice per active task order each month. The ACE 
contract is comprised of 21 individual task orders. As of May 5, 2005, 8 task 
orders were active. CBP contracted with Robbins-Gioia to assist in the day- 
to-day management of ACE contract operations. The Program Office has 
assigned an Acquisition Director to manage each task order. In addition, a 
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Business Manager from Robbins-Gioia works with each Acquisition Director. 
Together, the Acquisition Director and the Business Manager perform the 
technical review of an invoice. 

The Contracting Office entered into a time and materials contract with 
Stratecon LLC to provide contract administration support services for the 
workload associated with eCP. Stratecon LLC contract services include 
reviewing and evaluating monthly invoices by performing the financial review 
of an invoice for the Contract Officer. 

During the initial three days of an invoice review, the Contracting Office 
verifies the arithmetic totals and ensures that the invoice is in the correct 
format. If there is an arithmetic error or the format is incorrect, the 
Contracting Office will return the invoice to eCP. Otherwise, the Contracting 
Office and the Acquisition Directors will perform their respective reviews. 
The Contracting Office staff compiles problems found during the invoice 
reviews into an issues log and provides a copy of the issues log to eCP. After 
receiving eCP's responses to the issues, the Contracting Office, the Program 
Office, and the Acquisition Director then make the final recommendation for 
approval, suspension, or rejection of payment to the Contracting Officer. 
Based on the recommendation, the Contracting Officer makes a determination 
to reject, accept, or partially pay the invoice. If approved, the Contracting 
Officer prepares an approval letter that is sent together with the invoice and 
supporting documentation to the Indianapolis Finance Center by the 26 th day 
from the invoice receipt date. This allows the invoice to be paid within the 30 
days required by the Prompt Payment Act. See appendix C for a detailed 
diagram of the Invoice Procedure Steps. 

The Government Accountability Office (GAO) Standards for Internal Control 
in the Federal Government, dated November 1999, states that internal controls 
are comprised of the plans, methods, and procedures used to meet an 
organization's mission, goals, and objectives. The procedures should provide 
reasonable assurance that the objectives of the program are accomplished. 
The standards require management to continually assess and evaluate internal 
controls to assure that the control activities being used are effective and 
updated when necessary. The standards also require that all transactions and 
other significant events of the internal control systems be clearly documented, 
and that the documentation be readily available for examination. 

Prior Audits 

DHS and DCAA have a memorandum of understanding that allows CBP to 
request audits from DCAA. However, DCAA audits major contractor systems 
for all federal contracts, not specifically the ACE contract. DCAA conducted 
an incurred cost audit for IBM's FY 2002 incurred costs. In addition, DCAA 
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reviewed IBM's internal controls in 2003 for its purchasing system, the 
budget and planning system, the billing system, and the labor system. All 
DCAA audits concluded that IBM's internal controls were adequate. 

The Program Office Quality Assurance Team conducted an audit of the 
invoicing process in November 2004, which found issues similar to our audit 
results. Quality assurance audits aid program management in the monitoring 
of ACE processes. The purpose of the audit was to ensure that the invoicing 
process reflected current Program Office policy and that the processes were 
institutionalized and generating their intended value. The quality assurance 
report found that the documented processes had not been updated to reflect 
"how business is currently done." The report also noted that the documented 
processes and procedures do not include the "low-level details covering the 
day-to-day activities" for the invoicing process. 

Results of Audit 

CBP Review of Invoices 

CBP's internal controls for the review and approval of invoices were not 
adequate. Specifically, (1) written guidance describing review procedures 
was not sufficiently detailed, (2) reviewers did not always document the 
review activities performed, and (3) CBP did not sufficiently research the 
causes of issues identified during reviews. This occurred because CBP 
management did not adequately monitor invoice review operations. 
Consequently, CBP risks not detecting invoice errors or irregularities. 

CBP's existing written standard operating procedures for the review and 
approval of contractor invoices were contained in two documents: Invoice 
Review and Approval Procedures and the Invoice Review and Approval 
Process. Together, these documents contained the specific steps for reviewing 
and approving invoices and described the activities, products and staff 
positions that implement the process. The Invoice Review and Approval 
Procedures include one checklist for the financial review and one checklist for 
the technical review. The Contracting Office staff is responsible for 
performing the financial review of invoices and the Program Office 
Acquisition Directors and Business Managers are responsible for performing 
the technical review of invoices. 

Written Guidance 

The standard operating procedures for the verification of five major cost 
elements did not provide reviewers with sufficiently detailed guidance to 
effectively and consistently verify the accuracy, reliability and completeness 
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of invoices. The five major cost elements reviewed included direct labor 
hours, inventory purchases, billable overhead, general and administrative 
expenses, and fixed contract fee. 

Direct Labor Hours 

CBP's written standard operating procedures for the verification of labor 
hours were incomplete and did not provide sufficient guidance to invoice 
reviewers. In addition, some written procedures were duplicative or could be 
strengthened to be more effective. 

Below are two examples of incomplete written procedures that did not 
adequately describe how to review invoices. 

• Reviewers verified labor hours on an invoice by comparing the 
Customs Labor and Ledger Report to the labor hour details in the 
invoice package. However, the procedures lacked specific instructions 
for how to use the Customs Labor and Ledger Report to verify the 
labor hours on an invoice. The written procedures did not describe the 
methodology, documents, or systems to verify the labor hours on an 
invoice. For example, the procedures did not explain which specific 
sections of the Customs Labor and Ledger Report the reviewer should 
compare to the invoice. 

• The written procedures for the financial and technical review of an 
invoice required the reviewers to verify that the labor charges for IBM 
and subcontractors were not previously billed. The procedures do not 
describe or explain how the reviewer could detect duplicate charges. 
The Contracting Office staff said they would detect duplicate charges 
only "by luck." This is important since CBP frequently receives 
invoices from eCP that include labor charges for work performed by 
subcontractors six or more months before the invoice date. 

The procedures required both the financial and technical reviewers to 
perform identical steps related to the verification of labor charges. Duplicate 
procedures decrease the effectiveness and efficiency of invoice reviews. 
Examples of identical procedures performed by both the financial and 
technical reviewers include: 

• "Are all labor hour anomalies (i.e. >300 hours and/or prior period 
adjustments of >100 hours) sufficiently explained?" 

• "Is the period of performance unique to all other billings?" 
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• "Is the period of performance for all labor hours within the contract 
period of performance?" 

The procedures required the Contracting Office staff to perform certain 
invoice procedures that were not effective. For example, the procedures 
required the reviewer to verify the labor hours for at least one employee per 
vendor on an invoice. However, some invoices contain labor charges for 
more than 200 employees. In our opinion, verifying the labor hours for only 
one employee per vendor is not sufficient to deter or detect possible errors. 
Selecting larger employee samples would increase the likelihood of deterring 
or detecting errors or possible misuse, help management identify significant 
patterns or trends and make the review of labor hours more effective. 

Inventory Purchases 

The Contracting Office staff performed two steps for reviewing inventory 
purchases that enhance accountability of property. These two steps were not 
included in the written guidance. 

• The Contracting Office staff verified the classification of inventory items 
to ensure that accountable property was correctly classified. 

• The Contracting Office staff verified that a copy of the accountable 
property inventory file accompanied all property classified as accountable 
property. 

Billable Overhead 

The Contracting Office staff performed some steps to verify billable overhead. 
However, the written guidance did not describe the procedures required to 
verify billable overhead. For example, the procedures do not - 

• require the verification of overhead calculations. 

• specify the number of IBM employees that the Contracting Office staff is 
required to spot check on an invoice. 

• prescribe a minimum allowable variance between the billable overhead 
cost on the invoice and the cost calculated by the Contracting Office staff 
before reporting the issue. 

• provide guidance or instruction for verifying retroactive adjustments made 
based on estimated and actual overhead rates, and DCAA audits. 
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General and Administrative (G&A) Expenses 



CBP reviewers performed steps to verify G&A expenses that needed to be 
included in the procedures, and other steps needed to contain more detail 
guidance to reviewers. Below are examples. 

• CBP routinely verifies the mathematical accuracy of the G&A rate, 
however the procedures did not include this step. 

• The procedures did not inform the reviewer that the G&A rate was subject 
to annual revision once the actual G&A rate is determined by using the 
IBM G&A expenses. This would require the reviewer to subsequently 
review G&A costs to ensure that adjustments were made properly. 

• The procedures did not prescribe a minimum allowable variance between 
the Contracting Office staff calculation of G&A and the invoice amount. 

Fixed Contract Fees 

The Invoice Review and Approval Procedures document does not contain any 
reference to, or guidance for, the review of fixed fees. Neither the financial 
nor the technical checklist addressed the verification of fixed fees. Fixed fee 
rates ranged from 3% to 7.5% of the total cost on the invoice (except for travel 
costs) in our sample of invoices. The fixed fee for one invoice in our sample 
was $83,548.24. The fixed fee rates are negotiated by task order and are 
described in the negotiation summary. At a minimum, the written procedures 
should: 

• Assign responsibility for the verification of fixed fees to either the 
Program Office or the Contracting Office. 

• Require the reviewer to verify the fixed fee rate on the invoice against the 
negotiation summary. 

• Require the reviewer to determine the applicable formula from the 
negotiation summary for the computation for the fixed fee. 

Documentation of Invoice Reviews 

CBP did not always maintain documentation of the work performed in an 
invoice review. Reviewers used the checklists as a guide to reviewing 
invoices but not all reviewers completed and documented the work performed 
on the checklists. Therefore, we could not verify the work performed by 
reviewers or determine whether the control procedures were effective or 
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consistently applied. The written procedures did not require reviewers to 
document and maintain the work they performed to verify an invoice. 
Completed checklists to document invoice reviews would provide 
management with information on trends and systemic problems. 

The written procedures include a financial review checklist and a technical 
review checklist (See Appendix E, Invoice Checklist). Review checklists 
provide spaces for the reviewer to enter the task order number, contract 
number, invoice number, and invoice date. However, reviewers did not 
complete the checklists and attach them to the invoice maintained in the 
Contracting Office files. Without a completed checklist or other 
documentation showing the work performed by the reviewer, we could not 
determine whether the reviewers effectively verified the accuracy, reliability, 
and completeness of contractor invoices before payment. 

If the reviewers did not identify issues for the issues log, CBP had no record 
of verification procedures that reviewers performed. For example, the 
procedures require the technical reviewers to spot check the purchase of major 
dollar equipment by comparing the item on the invoice to supporting detail 
contained with the invoice. Unless a problem, concern or issue related to the 
purchase of equipment was included in the issues log, no documentation 
existed to prove that the reviewers verified any equipment purchases. At a 
minimum, reviewers should document the specific major dollar equipment 
that was verified. Another example is the verification of labor hours. The 
financial review checklist requires the reviewer to spot check the labor hours 
for one employee per vendor against the labor report. However, there was no 
documentation that reviewers verified labor hours, unless a discrepancy 
between the labor hours on the invoice and the labor hours on the labor report 
was included on the issues log. At a minimum, CBP should have 
documentation of the name of the employee that the reviewer spot-checked 
and verified. 

Research of Issues 

CBP did not effectively research eCP's responses to the issues log. As a 
result, issues found during the invoice reviews were not completely resolved 
and recurred on subsequent invoices. Additionally, CBP could have internally 
resolved some of the issues identified on the issues log without requiring 
eCP's time and effort. 

Contracting Office staff recorded issues identified during the invoice review 
process on the issues log, which was then forwarded to eCP for explanation. 
Issues included concerns such as, discrepancies between labor hours on the 
invoice and labor hours in the Customs Labor and Ledger report, concerns 
regarding labor overhead rates, and incorrect work packages or computations. 
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The Contracting Office and the Program Office staff accepted the 
explanations from eCP and closed issues without further verification, 
investigation, or follow-up. The Contracting Office acknowledged that they 
have accepted eCP's responses to the issues log without additional research 
because there was a "push" to be sure the invoices got processed and paid 
timely. The following three examples identify issues that needed further 
research. 

First, on two separate invoices, the Contracting Office could not verify the 
labor hours for employees using the Customs Labor and Ledger Report and 
included the names on the respective issue log. The eCP response stated that 
the labor hours on the invoice exactly matched the Customs Labor and Ledger 
Report and included an extract of the report as supporting documentation. 
The Contracting Office accepted the response without further verification. 
We asked the Contracting Office to verify eCP's response for the two 
employees as part of our sample in the testing of the effectiveness of internal 
controls related to labor hours. The Contracting Office could not verify the 
labor hours when comparing the labor hours on the invoice to the Customs 
Labor and Ledger Report. To test the effectiveness of the labor hour 
verification process, we judgmentally selected five employees from 15 
invoices for a total of 75 employees and observed the Contracting Office 
verify their labor hours. The Contracting Office was only able to verify the 
exact number of labor hours for 13 of the 75 employees on the invoice by 
comparing the invoice to a section of the Customs Labor and Ledger Report. 
If CBP had verified eCP responses that hours matched back to the Customs 
Labor and Ledger Report, CBP would have detected that they were not using 
the correct section of the report. However, they continued to identify 
differences with the labor hours and post them on the issues log. Research of 
labor hour issues would have detected that CBP procedures to verify labor 
hours were ineffective. 

Second, further research into the cause of the discrepancies in the labor hours 
might have alerted CBP management to an internal control design weakness. 
Specifically, IBM prepares both the invoice and the Customs Labor and 
Ledger Report from the same accounting system, essentially furnishing the 
same information in two different formats (See Appendix D for IBM Systems 
Diagram). The procedure performed by CBP only verifies the consistency 
between the report and the invoice; it does not actually verify that the labor 
hours were worked on this contract. Procedures that are unlikely to detect 
misstatements or errors could add unnecessary cost. 

Third, the Contracting Office staff questioned an overhead calculation for an 
employee on the issues log. The invoice showed that the employee worked 61 
hours during the period January 1 through February 1, 2005. eCP responded 
with a breakdown of how they calculated the overhead amounts. The 
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breakdown reflected 39 labor hours for 2004 overhead rates and 22 hours for 
2005 overhead rates. The breakdown of their computation supported the 
amount on the invoice, but the Contracting Office staff did not investigate or 
adequately resolve the following problems raised by eCP's response. 

• If the employee worked 39 hours in 2004, then the period of performance 
on the invoice was incorrect. 

• If the employee worked 39 hours in 2004 and 22 hours in 2005, then the 
Customs Labor and Ledger Report would not support the invoice because 
it would not show 61 hours for the employee during the period January 1 
through February 1, 2005. Either the hours on the invoice were wrong or 
the hours on the Customs Labor and Ledger Report were wrong. 

• If the employee worked the hours in 2004, then the Contracting Office 
staff needed to ensure that they did not pay for those labor hours on a prior 
invoice. 

Conclusion 

The weaknesses in the internal controls over the invoice review process 
increase the risk of improper payments. To strengthen internal controls, CBP 
needs to improve written procedures, better monitor the process, document the 
review activities performed, and research the cause of discrepancies noted 
during the review. This will allow management to ensure that reviewers for 
all task orders effectively and consistently applied invoice review steps. In 
addition, the fact that CBP plans to spend over a billion dollars on ACE over 
the next four years represents an inherent risk for the invoice review process. 
While DCAA incurred cost audits aid in reducing the risk, the last audit 
conducted by DCAA reviewed costs from 2002. 

Recommendations 

We recommend that: 

1 . The Program Office Director streamline and strengthen the internal 
controls over the invoice review process by: 

• eliminating redundant invoice review steps performed during the 
technical and financial reviews, 

• ensuring consistency between reviews of task orders for each cost 
element, 

• adequately researching the causes of problems noted in the issues logs, 
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• periodically monitoring the invoice review process to assure policies 
and procedures are effectively followed, and 

• requiring that the activities performed in the review of invoices be 
documented and retained with the invoice. 



2. The Contracting Officer should request DCAA to conduct an incurred cost 
audit for the ACE contractor. 



Management Comments and OIG Analysis: 

CBP concurred with the recommendations. DCAA is currently reviewing 
IBM's CY 2004 incurred costs. On July 20, 2006, CBP updated the Invoice 
Review and Approval Procedure, the Invoice Financial Review Checklist, and 
the Invoice Technical Review Checklist. Additionally: 

• CBP is monitoring invoice review activities to ensure consistency 
between reviews of task orders; 

• CBP is tracking the number and type of questions generated by the 
invoice review process to identify trends across task orders; 

• CBP has mandated that all associated invoice review documentation, 
including each checklist, be completed and retained in an invoice 
archive; and 

• CBP has appointed a government lead for ACE invoicing oversight, 
who meets with IBM's invoicing team on a bi-weekly basis to resolve 
invoicing issues, including the causes of problems noted in the issues 
logs. 



The actions taken by CBP satisfy the intent of our recommendations. 
Therefore, the recommendations in this report are considered closed. 



Award and Incentive Fees 



CBP adequately followed existing procedures and policies for monitoring, 
evaluating and measuring contractor performance for payment of award fees 
and product quality for payment of incentive fees. Our audit focused on the 
application of the measurement criteria and did not include assessing CBP's 
measurement criteria or validating CBP's performance measurements. 



The chart below summarizes payments through March 2005. See Appendix F 
for details. 

Available (millions) Percent 
Amount Earned Forfeit Paid 
Award Fee (Periods 1-5) $18.4 $4.0 $14.4 22% 

Incentive Fee (30 incentives) 13.5 11.0 2.5 81 % 
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The Award fee amounts were paid based on performance ratings. The 
contractor' s performance evaluation reports for five-performance rating 
periods did contain adequate justifications to support the contractor's ratings. 
The general performance ratings include program management, cost, and 
technical quality. CBP used a consultant to assist in managing the Award Fee 
process for evaluating contractor's performance. The consultant gathered 
comments and tallied the rating results from Acquisition Directors, task order 
staff, program level personnel and CBP management. Using the results, the 
consultant develops the performance evaluation report for the Performance 
Evaluation Board and the Fee Determination Official. 

CBP properly tracked, monitored, and measured incentive fees in accordance 
with the negotiated terms and verifiable measurement results. Incentive fees 
may include, but are not limited to, specific system performance metrics, 
milestones, service level, and cost savings. CBP used incentive fees to reward 
the contractor for providing quality deliverables for specific task orders, that 
CBP determined needed to be accomplished or sustained in order to improve 
the program. 
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Appendix A 

Purpose, Scope and Methodology 



The overall objective of the audit was to assess the internal controls related to 
the review and approval of ACE contractor invoices. The audit focused on 
two specific questions: (1) Were the procedures, processes, and internal 
controls adequate to verify the accuracy, reliability, and completeness of 
contractor invoices prior to payment? (2) Was the process for evaluating the 
quality of contractor performance and related award and incentive fee 
payments effective? 

This audit was performed at various DHS locations within the Washington, 
D.C. area. During our audit, we selected and reviewed 15 eCP invoices from 
December 2004 to April 2005 with a total value of $22.3 million and three (3) 
Robbins-Gioia invoices from March 2005 to May 2005 with a total value of 
$3.9 million. The audit included reviewing the Program Office policies, 
procedures, and controls, testing the controls by sampling 15 eCP invoices, 
and evaluating the documentation of the results of invoice reviews and 
approvals. 

We assessed CBP's internal controls for the invoice review and approval 
process. The internal controls for the review of an invoice serve to protect the 
Government's interest by ensuring that payment is commensurate with the 
work performed. We performed these steps to assess internal controls: 

• evaluated CBP's policies and procedures used by reviewers for 
relevant internal controls, 

• observed invoice reviews performed by CBP for five major cost 
elements, 

• evaluated documentation supporting reviews to determine if 
transactions were properly documented, and 

• reviewed documentation provided by the contractor to support 
invoiced amounts 

Our examination specifically tested the invoice review and approval system's 
internal control procedures associated with the following control activities: 

• Management Reviews for Actual Performance 

• Policies and Procedures 

• Implementation of Policies and Procedures 

• Accurate and Timely Recording of Transactions and Events 

• Appropriate Documentation of Transactions and Internal Control 

We evaluated the Program Office invoice and approval system using the 
applicable requirements contained in the Federal Acquisition Regulation, and 
Standards for Internal Controls in the Federal Government. 
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Appendix A 

Purpose, Scope and Methodology 



We reviewed the pertinent plans and documents related to the design, 
development, implementation, documentation and effectiveness of the ACE 
Invoice Review Process, including: 

• Invoice Review and Approval Process Version 1.0 

• Invoice Review and Approval Procedure Version 3.0 

• Funds Management Process Version 1.0 

• eCP Invoicing Process Version 1.2 

• Change Request Process 

• eCP ACE Contract 

• Stratecon Contract Requirements 

As of May 5, 2005, 21 task orders had been issued for ACE, of which eight 
were active. We judgmentally selected three of the eight task orders based on 
the following criteria: 

• One Task Order (TO 17) where a portion of the invoice was 
disallowed. 

• The highest total dollar amount on the most recent invoices (TO 19) 

• A task order related to the next ACE Release, Release 5 (TO 21) 

We gathered data on the invoice review processes and procedures through 
structured interviews, document analysis, and observation of operations. We 
selected the 5 most recently processed and paid invoices for each of the 3 task 
orders to test the effectiveness of controls for General and Administrative 
Fees, Overhead Rate and Fixed Fees. 

To test the effectiveness of the control procedure for the verification of labor 
hours, we judgmentally selected five (5) employees from each of the 15 
invoices for 75 employees. There were 32 IBM employees and 43 
subcontractor employees. 

Inventory purchases are processed through task order 19. To test the 
effectiveness of the control procedures for the verification of inventory 
purchases, we examined inventory items on the five invoices which contained 
inventory purchases. 

We conducted our audit between May 2005 and May 2006 under the authority 
of the Inspector General Act of 1978, as amended, and according to generally 
accepted government auditing standards. 
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Appendix B 

Management Comments 



U.S. Department of Homeland Security 

Washington, DC 20229 

(fiSSfth U.S. Customs and 
W308 Border Protection 



September 5, 2006 



MEMORANDUM FOR RICHARD L. SKINNER 
INSPECTOR GENERAL 

DEPARTMENT OF HOMELAND SECURITY 

FROM; wVLPirectfc^ 

J Officer of Policy ^nd Planning 

SUBJECT: Response to the Office of Inspector General's Draft Report 

on Management Controls Over Automated Commercial 
Environment Contractor Billings 

Thank you for providing us with a copy of your draft report entitled "Audit of 
Management Controls Over Automated Commercial Environment (ACE) 
Contractor Billings" and the opportunity to discuss the issues in this report. We 
are providing the following clarifying comments to reinforce the fact that U.S. 
Customs and Border Protection (CBP) takes the findings of this report very 
seriously and is doing everything possible to ensure proper payments. 

As discussed at the exit conference, CBP is concerned that the wording of the 
report will leave an impression that CBP has not taken sufficient actions to 
eliminate the risk of improper payments to ACE contractors. The invoice review 
procedure and associated checklists are in place to ensure that the government 
exercises due diligence in the review of each invoice. Improvements to the 
procedure have been communicated to CBP staff when needed. However, CBP 
agrees that the procedure and checklists needed to be formally updated to ensure 
that CBP makes proper payments. The ACE Process Group approved the 
updated Invoice Review and Approval Procedure on July 20, 2006. 

Though the procedure needed to be updated, the prior operating model was 
operating effectively. The draft Office of Inspector General (OIG) report did not 
document any invalid payment made by CBP CBP has received over 800 ACE 
invoices totaling over $1 billion. Of this amount, CBP has withheld approximately 
$12 million as a result of its invoice review procedure. Additionally, CBP 
completes a thorough task order closeout procedure to ensure proper charges 
have been accurately billed and paid Finally, the Defense Contract Audit Agency 
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Appendix B 

Management Comments 



2 

(DCAA) completed a number of audits of IBM Global Services-Federal Integration 
Organization. All of the audits found that IBM's internal controls are adequate. 

The OIG made two recommendations in its report, CBP concurs with both 
recommendations. A detailed status of the actions taken by CBP to address the 
recommendations is attached. 

With regard to the classification of the draft report, CBP's review of the draft report 
did not reveal any portion that requires protection under a Freedom of Information 
Act exemption. 

If you have any questions regarding this response, please contact me or have a 
member of your staff contact Ms. Lynn Richardson at (202) 344-2953. 

Attachment 
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"Audit of Management Controls Over Automated 
Commercial Environment (ACE) Contractor Billings" 

CBP Corrective Action Plan 

Recommendation 1: The Program Office Director streamline and strengthen 
internal controls over the invoice review process by: 

• Eliminating redundant invoice review steps performed during the technical 
and financial reviews; 

• Ensuring consistency between reviews of task orders for each cost 
element; 

• Researching the causes of problems noted in the issues log, 

• Periodically monitoring the invoice review process to ensure policies and 
procedures are followed; and 

• Requiring that the activities performed in the review of invoices be 
documented and retained with the invoice. 

CBP Response: CBP has streamlined, strengthened, and documented its internal 
controls associated with the invoice review process. CBP has updated the Invoice 
Review and Approval Procedure, the Invoice Financial Review Checklist, and the 
Invoice Technical Review Checklist (all approved by the ACE Process Group on 
July 20, 2009). Additionally; 

• CBP is monitoring invoice review activities to ensure consistency between 
reviews of task orders; 

• CBP is tracking the number and type of questions generated by the invoice 
review process to identify trends across task orders; 

• CBP has mandated that all associated invoice review documentation, including 
each checklist, be completed and retained in an invoice archive; and 

• CBP has appointed a government lead for ACE invoicing oversight, who meets 
with IBM's invoicing team on a bi-weekly basis to resolve invoicing issues, 
including the causes of problems noted in the issues logs. 

Due Date: CBP considers this recommendation closed. 

Recommendation 2: The Contracting Officer request DCAA to conduct an 
incurred cost audit of the ACE contractor. 

CBP Response: The Contracting Officer routinely submits an audit request to 
DCAA to assess IBM's Calendar Year (CY) incurred costs on an annual basis due 
the fact that cost-reimbursable type task orders are awarded. Audit requests to 
DCAA for review of IBM's CY 2002, CY 2003, and CY 2004 incurred costs were 
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Appendix B 

Management Comments 



4 

submitted. Audit reports on IBM's CY 2002 incurred costs are in receipt. DCAA is 
currently reviewing IBM's CY 2004 incurred costs. DCAA anticipates completing 
the 2004 audit in mid-November 2006. 

Due Date: November 30, 2006. 
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Appendix C 

Invoice Procedure Steps 



Day 
20-23 



Day 1-10 



2. CSPO and 
Procurement 
receive invoice 
simultaneously 



3, Procurement 
completes initial 
review of invoice 
(3 days) 




No 



1. eCP 
submits 
invoice 



5. Procurement 
arranges meeting 
to review invoice 
with AD 



6. Procurement completes 
financial review 
(7 days) 



7. CSPO completes 
technical review 
(7 days) 



4. CO rejects 
invoice 



14. 

Procurement 

prepares 
contract letter 
for CO 





Day 15-19 i 










I 




13. AD approves 




12. Procurement, 




1 1 .Procurement 




final payment 




CSPO, and AD 




consolidates 




recommendation 




meet to review 




issues, 


< 


on behalf of 


< 


and determine 




responses, and 




CSPO 




final payment 




payment 










recommendation 




recommendation 



15. CO 
approves 
invoioe and 
coordinates 
payment with 
finance 



16. Office of 
Finance issues 
final payment 



17. Procurement 
updates invoice 

log and files 
payment record 



Day 24-30 



END 



3 



8 Procurement 




consolidates Issues 




into one issue log 










9. Procurement 






sends respective 






issue log to eCP (cc: 






CSPO) 




Days 








11-14 


_ 1 




10. eCP provides 






responses to 






Procurement 






(cc: CSPO) 




(2 days) 





Source: Invoice Review and Approval Procedure Version 1.0, dated July 31 , 2003 
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Appendix D 

IBM System Diagram 



The following diagram illustrates the two databases that feed labor hour 
information to the IBM accounting system and the two outputs. 



IBM Labor 
Claiming 
Database 



Subcontract 
Labor 
Claiming 
Database 



=> 

7^> 



ACCOUNTING 
SYSTEM 



Outputs 



Invoice 
Including IBM and 
Subcontractor labor 

backup 



Customs Labor and 
Ledger Report 



Each invoice from eCP includes documentation that provides details on the 
charges for IBM and subcontract labor. The detailed documentation consists 
of tables that identify the employee, the workpackage (assignment), period of 
performance, and number of hours worked during the period of performance. 

Additionally, the IBM accounting system produces a weekly labor report 
entitled the Customs Labor and Ledger Report and IBM posts the report on 
the CBP intranet. This labor report details the hours charged by week to the 
ACE program by employee name and workpackage (assignment). 

CBP reviewers perform spot checks of labor hours on an invoice by 
judgmentally selecting an IBM or subcontract employee from the detailed 
documentation in the invoice package and comparing the number of hours on 
the invoice to the number of labor hours in the Customs Labor and Ledger 
Report. 
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Appendix E 

Invoice Review Checklist 



ATTACHMENT A 
Invoice FINANCIAL Reuie** Checklist 

7as!tOr<SBr-9 Contractu „_„ 

Invoice * Invoice Date 



a. Invoice Summary Shfrgt 



Dow the rrweice include Bis date, POP and amount? 








Odes the overh&afj rate asree wftri negotiated task order rsl^7 








Does flic G&Arati-s a-grsQ *ftlr ths nasjcflaled (ask brdor rales'* 








Dees the current invoice total <■ Jssi invaioc cumulative total - current 
njmursflvo total? 








□a this back-up documsnte match the summary shoe)? 









^re ail WBSlDs stiargeo to corne.ct taste ordsrs? 








Are any lalwt Hour anomalies (i e > SCO tours andtor prior period 
etijusfcrrisnis flf> 1(3p hsiirrs) sjriioiisr'tlysXfllEiinetfi 








Soot ctietSi lira lab«r rrsws against the labor report fat [east one person 
par vender). e tte InforTrriqtion consistory? 








13 (he pqp iirtfljji* tp aifijttrarbillinns rj.s-, verily itretjiie sh arges riava 
net tiscn pre^aiiily billsd)? 








Is the POP for u! labor hours within I he contract POP? 








Ware Hie rnar-m hEw*ry r^tes v$*rifie*i? 








Oo the hours on the back-up egfresporKi v; th Die Invoice sum ma ry 
sheet' 









firs all wlgsiDathargnd to cmrrEd task orders? 








Ara any labor hour anomalies (1 .e. > 300 tours arioVor prior parted 
aqjusiiTisrUB e f f ' iflg fi^ursj awfltosnt/y vpiplainsd? 








Were lbs macro hourly rates voMlted? 








la iha POP uniaiiB to all ether billings (i.e.. uerHj. that fto qherg w5 hwo 
riAt bson previously SilJaiS? 








Is Bib POP tor all labor hours with In Ihs contract POP? 








Spot check the Isfcar hours againat Ste Irtoi report jat itasl fine pErron 
psr vendor], .Is; the InforrtistloriCDnfislent? 








Do trie hour6 on tfis back-up ccrrespontt wjffi the invoice summary 









cL Epuipmont Purchases 



Does the rack-up correspond with the iry/oloe summary sheets 








Are us pqn SS „t rwuesl, aurora! leffer, snd price r^aspnafclsres? ef 
purchase (where ajjpiicabb) inclutied? 








Are P+MS rwrntjers indudsd? Spot chack to ariaura actual PW3 entry 
exists arid is accurate. 









Doss the baokup correspond with tfie Irevet summary sheet? 








^ i.ib purpp?^ dffscpp*i»ri an^taiip^ign »tu gnd trorn ,r for esach JravcJ 








id th^ J"m psi dtem fcrikmed and checked for any ^noirmiies^ 









f QDC 



Pa all P^Ca have a aesaipljon and puipase? 
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Appendix E 

Invoice Review Checklist 



ATTACHMENT B 
Invoice TECHNICAL Review Checklist 

TaskOitfstH Contact* 



1ES 

a- Invoice Summary Sheet 


fl2 




I Has a spot check for any inoonsiatereaas beer performed 9 








b- IPM Labor Hews 


Are any labor tour BnBmalies (i.e. > 300 rioura and/or prior period, 
adjustments of =■ 1C0 hour*) aufiiaentfy ex»lairHtf? 








Doss tftft backup malrji (he summary pasje? 








Is the POP unique to all nthpi t}i||| r? p £. e „ verify incite charges hare nnj 
been previously biffed)? 








te the PQP for all labor hours within Slio spntrsjcl POP 7 








Vte kngvstadgs sf tuft anJars applied to vojify (rat IfiBSIBs sre valid and 
consistent wltii the work performed? 








Was knowledge sf task orders applied to spot check validity of known staff 
merntwrs ft- s , ds \ retogfijaj sny n^rn^s t)iat $touU nqf be cm this 

invoice?)? 









c. Sub-Conhractara Labor Hours 



— . . 

tettie POP uniqus to ail other fa lings (le„ verify thai tta charges have nut 
been previously i?llled)7 








is tits POP for ell labor hours within the contract PD P? 








Are any Jator hour anomalies (1.9. p 3Qrj hours and/or prior period 
adjustments of 9 10C hours) siiffidantly ^plained? 








d. Equipment Purchases 


hhh b gp^t cruses a* consifiteni. major de/lsr items wiiri supporting detslted 
irrTtTiTiaiion baen oarformetj?. 


- 




1 


<f. 1 ravel 






Has a spa! crnwk cf s>wirie$ for any ancmslies teon perfonncrj'J 








1. ODC . 









Be afl QDGs have a descriptor! and purpose explained? 
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Appendix F 

Award and Incentive 



AWARD FEE HISTORY 

Award Available 

Period Rating Pool * Awarded Forfeit 

1 74% $1,000,000 $740,000 $260,000 

2 Failing 3,000,000 - 3,000,000 
2 and 3 56% 8,500,000 - 8,500,000 

4 64% 2,100,000 - 2,100,000 

5 87% 3,800,000 3,300,000 500,000 

Totals $18,400,000 $4,040,000 $14,360,000 

22% 78% 
* Includes rollover amounts from previous periods 

Completed Incentives 

Task Percent Percent 



Order Available Earned Not Paid Paid Not Paid 



4 


$ 484,488 $ 


484,488 $ 




100.0% 


0.0% 


8 


3,263,898 


2,962,615 


301,283 


90.8% 


9.2% 


9 


818,931 


614,198 


204,733 


75.0% 


25.0% 


16 


2,144,719 


1,797,388 


347,331 


83.8% 


16.2% 


17 


2,747,544 


2,546,311 


201,233 


92.7% 


7.3% 


17.1 


27,120 


27,120 




100.0% 


0.0% 


19 


3,689,010 


2,210,616 


1,478,394 


59.9% 


40.1% 


20 


112,082 


112,082 




100.0% 


0.0% 


21 


239,582 


239,582 




100.0% 


0.0% 




$ 13,527,374 $ 


10,994,400 $ 


2,532,974 


81 .3% 


18.7% 



As of March 2005 
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Appendix G 

Major Contributors to this Report 



George Tabb, Director, Trade Operations and Security Division 

Gene Wendt, Audit Manager 

Carlos Berrios, Auditor In Charge 

David Porter, Auditor 

DeWayne Bailey, Auditor 

Michael Lugo, Auditor 
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Appendix H 
Report Distribution 



Department of Homeland Security 

Secretary 

Deputy Secretary 

Chief of Staff 

Deputy Chief of Staff 

Assistant Secretary for Policy 

Assistant Secretary for Public Affairs 

Assistant Secretary for Legislative and Intergovernmental Affairs 
General Counsel 
Executive Secretary 
Chief Privacy Officer 
Director, GAO/OIG Liaison 

Customs and Border Protection 

Commissioner, Bureau of Customs and Border Protection 
CBP OIG Liaison 

Director, Cargo Systems Program Office 
ACE Contract Officer 

Office of Management and Budget 

Chief, Homeland Security Branch 
DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committees, as appropriate 
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Additional Information and Copies 

To obtain additional copies of this report, call the Office of Inspector General 
(OIG) at (202) 254-4100, fax your request to (202) 254-4285, or visit the OIG 
web site at www.dhs.gov/oig. 



OIG Hotline 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of 
criminal or noncriminal misconduct relative to department programs or 
operations, call the OIG Hotline at 1-800-323-8603; write to DHS Office of 
Inspector General/MAIL STOP 2600, Attention: Office of Investigations - 
Hotline, 245 Murray Drive, SW, Building 410, Washington, DC 20528, or email 
DHSOIGHOTLINE@dhs.gov. The OIG seeks to protect the identity of each 
writer and caller. 



